Forward port of all latest 2.5 changes

diff --git a/helpers/external_acl/ldap_group/ChangeLog b/helpers/external_acl/ldap_group/ChangeLog
index 7914e6cb687843b11d26844a824170d11ca2d0a7..de1665c947028f6e6e1af887ff963aa3d56a772d 100644 (file)
--- a/helpers/external_acl/ldap_group/ChangeLog
+++ b/helpers/external_acl/ldap_group/ChangeLog
@@ -1,3 +1,9 @@
+Version 2.16
+
+2004-10-21 Henrik Nordstrom <hno@squid-cache.org>
+
+       Documentation fixes
+
 Version 2.15
 
 2004-08-15 Henrik Nordstrom <hno@squid-cache.org>

diff --git a/helpers/external_acl/ldap_group/squid_ldap_group.8 b/helpers/external_acl/ldap_group/squid_ldap_group.8
index 74769aa4b25b223f2eede8659837032c32d747df..4bafafd8ac36bc1c127845ea029f53a4cea37fad 100644 (file)
--- a/helpers/external_acl/ldap_group/squid_ldap_group.8
+++ b/helpers/external_acl/ldap_group/squid_ldap_group.8
@@ -1,4 +1,4 @@
-.TH squid_ldap_group 8 "17 July 2004" "Squid LDAP Group"
+.TH squid_ldap_group 8 "14 January 2005" "Squid LDAP Group"
 .
 .SH NAME
 squid_ldap_group - Squid LDAP external acl group helper
@@ -9,6 +9,15 @@ squid_ldap_group -b "base DN" -f "LDAP search filter" [options] [ldap_server_nam
 .SH DESCRIPTION
 This helper allows Squid to connect to a LDAP directory to
 authorize users via LDAP groups.
+LDAP options are specified as parameters on the command line,
+while the username(s) and group(s) to be checked against the
+LDAP directory are specified on subsequent lines of input to the
+helper, one username/group pair per line separated by a space.
+.P
+As expected by the external_acl construct of Squid, after
+specifying a username and group followed by a new line, this
+helper will produce either OK or ERR on the following line
+to show if the user is a member of the specified group.
 .P
 The program operates by searching with a search filter based
 on the users user name and requested group, and if a match
@@ -119,6 +128,10 @@ Specify an alternate TCP port where the ldap server is listening if
 other than the default LDAP port 389.
 .
 .TP
+.BI -v " 2|3"
+LDAP protocol version. Defaults to 2 if not specified.
+.
+.TP
 .BI -Z
 Use TLS encryption
 .

diff --git a/helpers/external_acl/ldap_group/squid_ldap_group.c b/helpers/external_acl/ldap_group/squid_ldap_group.c
index d97fbb83d3502497776aae40fad6bc549c0c418e..2d1efaef5db71588e50cd249a6c2c25982b65251 100644 (file)
--- a/helpers/external_acl/ldap_group/squid_ldap_group.c
+++ b/helpers/external_acl/ldap_group/squid_ldap_group.c
@@ -113,6 +113,10 @@ static int readSecret(char *filename);
 
 /* Yuck.. we need to glue to different versions of the API */
 
+#ifndef LDAP_NO_ATTRS
+#define LDAP_NO_ATTRS "1.1"
+#endif
+
 #if defined(LDAP_API_VERSION) && LDAP_API_VERSION > 1823
 static int 
 squid_ldap_errno(LDAP * ld)
@@ -672,6 +676,7 @@ searchLDAPGroup(LDAP * ld, char *group, char *member, char *extension_dn)
     LDAPMessage *res = NULL;
     LDAPMessage *entry;
     int rc;
+    char *searchattr[] = {LDAP_NO_ATTRS, NULL};
 
     if (extension_dn && *extension_dn)
        snprintf(searchbase, sizeof(searchbase), "%s,%s", extension_dn, basedn);
@@ -686,7 +691,7 @@ searchLDAPGroup(LDAP * ld, char *group, char *member, char *extension_dn)
     if (debug)
        fprintf(stderr, "group filter '%s', searchbase '%s'\n", filter, searchbase);
 
-    rc = ldap_search_s(ld, searchbase, searchscope, filter, NULL, 1, &res);
+    rc = ldap_search_s(ld, searchbase, searchscope, filter, searchattr, 1, &res);
     if (rc != LDAP_SUCCESS) {
        if (noreferrals && rc == LDAP_PARTIAL_RESULTS) {
            /* Everything is fine. This is expected when referrals
@@ -725,6 +730,7 @@ searchLDAP(LDAP *ld, char *group, char *login, char *extension_dn)
        LDAPMessage *entry;
        int rc;
        char *userdn;
+       char *searchattr[] = {LDAP_NO_ATTRS, NULL};
        if (extension_dn && *extension_dn)
            snprintf(searchbase, sizeof(searchbase), "%s,%s", extension_dn, userbasedn ? userbasedn : basedn);
        else
@@ -733,7 +739,7 @@ searchLDAP(LDAP *ld, char *group, char *login, char *extension_dn)
        snprintf(filter, sizeof(filter), usersearchfilter, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login, escaped_login);
        if (debug)
            fprintf(stderr, "user filter '%s', searchbase '%s'\n", filter, searchbase);
-       rc = ldap_search_s(ld, searchbase, searchscope, filter, NULL, 1, &res);
+       rc = ldap_search_s(ld, searchbase, searchscope, filter, searchattr, 1, &res);
        if (rc != LDAP_SUCCESS) {
            if (noreferrals && rc == LDAP_PARTIAL_RESULTS) {
                /* Everything is fine. This is expected when referrals